Checkmarx One vs SonarQube comparison

Checkmarx One
Read 68 Checkmarx One reviews
  • 31,928 Views
  • 20,416 Comparison Views
86% willing to recommend
SonarQube
Read 112 SonarQube reviews
  • 48,783 Views
  • 39,042 Comparison Views
81% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Jun 6, 2024

Checkmarx and SonarQube both offer static application security testing (SAST) with notable distinctions. Checkmarx is praised for its integration into the development lifecycle and developer-centric approach, albeit with a challenging UI and higher false positives. SonarQube, benefiting from a free Community edition, is valued for its broad language support and lower false positives but requires improvements in handling larger projects and a more accessible licensing process. Checkmarx users appreciate responsive support. SonarQube's customer service experiences are mixed. Setup is generally quicker and smoother with Checkmarx, contrasting with SonarQube's varied setup complexity.

  • Features: Checkmarx excels in seamless SDLC integration and actionable security reports. SonarQube offers a free Community edition, OWASP support, and low false positives. Both support multiple languages, however, SonarQube uniquely supports C/C++.
  • Pricing and ROI: Checkmarx setup costs are generally considered reasonable but have mixed reviews regarding their licensing structure’s transparency. SonarQube, being open-source, often incurs no initial cost, but the upgraded version requires licensing, which users find cumbersome. SonarQube's pricing is usually accessible and sometimes cheaper. Checkmarx offers efficient early detection, cost savings, and enhanced security. SonarQube provides long-term value through consistent use and bug-free coding. Checkmarx emphasizes immediate operational benefits; SonarQube, preventive assurance.
  • Room for Improvement: Checkmarx needs a more intuitive user interface and reduced false-positive rates, while SonarQube requires more comprehensive security coverage and better performance for large codebases. Checkmarx struggles with tool integration; SonarQube needs easier management reports and improved language support.
  • Deployment and customer support: Checkmarx is noted for its quicker and smoother setup and deployment phases, making it efficient for immediate use. SonarQube's setup experiences vary significantly, ranging from a few hours to two months, with some users finding it time-consuming due to user training needs. Checkmarx's customer service is highly praised for its responsiveness, knowledge, and timely issue resolution. SonarQube experiences vary; some users report positive interactions, while others suggest the support model needs improvement and often rely on community resources.

The summary above is based on 31 interviews we conducted recently with Checkmarx and SonarQube users. To access the review's full transcripts, download our report.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed Checkmarx One vs. SonarQube Report (Updated: July 2024).
Buyer's Guide
Checkmarx One vs. SonarQube
July 2024
Download the complete report
Helped 793,295 peers since 2012
 

Categories and Ranking

Checkmarx One
Ranking in Application Security Tools
3rd
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
7.6
Number of Reviews
68
Ranking in other categories
Vulnerability Management (12th), Static Code Analysis (2nd), API Security (4th), DevSecOps (2nd), Risk-Based Vulnerability Management (5th)
SonarQube
Ranking in Application Security Tools
1st
Ranking in Static Application Security Testing (SAST)
1st
Average Rating
8.0
Number of Reviews
112
Ranking in other categories
Software Development Analytics (1st)
 

Mindshare comparison

As of July 2024, in the Application Security Tools category, the mindshare of Checkmarx One is 13.0%, down from 15.4% compared to the previous year. The mindshare of SonarQube is 28.0%, up from 27.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
Unique Categories:
Static Application Security Testing (SAST)
11.1%
Vulnerability Management
0.6%
Software Development Analytics
50.0%
 

Q&A Highlights

WH
Jul 08, 2020
Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode
My opinions are my own and do not represent any other entities that I may be or have been affiliated with.  On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon.  As for Checkmarx vs SonarQube...  Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse.  SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it.  I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission.  In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode.  Hope that helps
See all answers
 

Featured Reviews

MM
Jun 18, 2020
Easy interface that is user friendly, quick scanning, and good technical support
Checkmarx has tried to build a deeper analysis using IAST and SAST. They have a code version for developers. It would be good if they improve the combination of the two solutions. Both are good, but ISAT (Interactive Application Security Testing) is in progress and doesn't support the full spectrum of languages. A combination of the two solutions would achieve good results. We have received some feedback from our customers who are receiving a large number of false positives. I believe that they can improve their engine to reduce false positives. It's better for reducing false positives when you use a compilation. There are several levels and they are mapped to the different languages and some customers want to check when the developers will pass the training. There should be a questionnaire for the team lead to check the employees and how well they understand the material and the training. Also, they will want to add their own content to this solution. I would like to see some improvements in technology to reduce false positives. This is only relevant to some use cases, not all. For example, there are several false positives for some languages, but it works in C#.
Read full review
BS
Dec 21, 2023
This solution is simple to use and can be quickly deployed
We use SonarQube to check for vulnerabilities and quality.  The solution has helped us to find flaws in the Syntax and comply with requirements.  I have found the most valuable features to be scanning for bugs or fixing the hotspot. These features have helped to improve the code quality.  I…
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The tool's valuable features include integrating GPT and Copilot. Additionally, the UI web representation is very user-friendly, making navigation easy. GPT has made several improvements to my security code."
"The only thing I like is that Checkmarx does not need to compile."
"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."
"Checkmarx pinpoints the vulnerability in the code and also presents the flow of malicious input across the application."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"The solution has good performance, it is able to compute in 10 to 15 minutes."
"It gives the proper code flow of vulnerabilities and the number of occurrences."
"It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx."
More Checkmarx One pros
"The depth features I have found most valuable. You receive a quick comprehensive comparison overview regarding the current release and the last release and what type of depths dependency or duplication should be used. This is going to help you to make a more readable code and have more flexibility for the engineers to understand how things should work when they do not know."
"With SonarQube's web interface, it is easy to drill down to see the individual problems, but also to look at the project from above and get the big picture, with possible larger problem areas."
"The most valuable features are that it is user-friendly, easy to access, and they provide good training files."
"It provides the security that is required from a solution for financial businesses."
"The most valuable feature is the security hotspot feature that identifies where your code is prone to have security issues."
"There's plenty of documentation available to users."
"It is an easy tool that you can deploy and configure. After that you can measure the history of your obligation and integrate it with other tools like GitLab or GitHub or Azure DevOps to do quality code analysis."
"I like that it's easy to navigate not just in terms of code findings but you can actually see them in the context of your source code because it gives you a copy of your code with the items that it found and highlights them. You can see it directly in your code, so you can easily go back and make the corrections in the code. It basically finds the problems for you and tells you where they are."
More SonarQube pros
 

Cons

"With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too."
"The solution sometimes reports a false auditable code or false positive."
"In terms of dashboarding, the solution could provide a little more flexibility in terms of creating more dashboards. It has some of its own dashboards that come out of the box. However, if I have to implement my own dashboards that are aligned to my organization's requirements, that dashboarding feature has limited capability right now."
"Micro-services need to be included in the next release."
"Updating and debugging of queries is not very convenient."
"This product requires you to create your own rulesets. You have to do a lot of customization."
"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."
"The solution's user interface could be improved because it seems outdated."
More Checkmarx One cons
"There isn't a very good enterprise report."
"The interface could be a little better and should be enhanced."
"If you don't have any experience with the configuration or how to configure the files, it can be complicated."
"After scanning our code and generating a report, it would be helpful if SonarQube could also generate a solution to fix vulnerabilities in the report."
"This is a well-rounded solution, however, some features could be made available on the free version. The price of the solution could be reduced."
"I am not very pleased with the technical debt computation."
"I would also like SonarQube to be able to write custom scanning rules. More documentation would be helpful as well because some of our guys were struggling with the customization script."
"Technical support and the price could be better."
More SonarQube cons
 

Pricing and Cost Advice

"The pricing was not very good. This is just a framework which shouldn’t cost so much."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"The solution's price is high and you pay based on the number of users."
"The solution is costly."
"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."
"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."
"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
"It is the right price for quality delivery."
More Checkmarx One pricing and cost advice
"People can try the free licenses and later can seek buying plugins/support, etc. once they started liking it."
"SonarQube price is a little bit higher than Kiuwan's. Kiuwan also gives a little bit of flexibility in terms of pricing."
"I requested this license for one million lines of code and they accepted this."
"The solution is cheaper than other products."
"The solution has a free version and a license version. The license is priced reasonably, the cost of hiring one programmer is more expensive than the solution."
"We're using their free Community Edition version."
"The developer edition is based on cost per lines of code."
"Get the paid version which allows the customized dashboard and provides technical support."
More SonarQube pricing and cost advice
report
See which vendors are best for you
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
See recommendations
793,295 professionals have used our research since 2012.
 

Answers from the Community

WH
Jul 8, 2020
Jul 8, 2020
Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode
My opinions are my own and do not represent any other entities that I may be or have been affiliated with. On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon. As for Checkmarx vs SonarQube... Checkmarx may cover more rules over a wider land...
2 out of 3 answers
DG
Jul 6, 2020
My opinions are my own and do not represent any other entities that I may be or have been affiliated with.  On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon.  As for Checkmarx vs SonarQube...  Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse.  SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it.  I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission.  In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode.  Hope that helps
Read full answer
DG
Jul 7, 2020
SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.
Read full answer
See all 3 answers
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
15%
Manufacturing Company
10%
Government
5%
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
12%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
See all answers
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
See all answers
What is your experience regarding pricing and costs for Checkmarx?
The tool's pricing is fine.
See all answers
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
See all answers
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
See all answers
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
See all answers
 

Comparisons

Veracode vs Checkmarx One Logo
Veracode vs Checkmarx One
Compared 13% of the time
Fortify on Demand vs Checkmarx One Logo
Fortify on Demand vs Checkmarx One
Compared 7% of the time
Snyk vs Checkmarx One Logo
Snyk vs Checkmarx One
Compared 4% of the time
Coverity vs Checkmarx One Logo
Coverity vs Checkmarx One
Compared 4% of the time
Mend.io vs Checkmarx One Logo
Mend.io vs Checkmarx One
Compared 2% of the time
More Checkmarx One Competitors
SonarCloud vs SonarQube Logo
SonarCloud vs SonarQube
Compared 13% of the time
Coverity vs SonarQube Logo
Coverity vs SonarQube
Compared 11% of the time
Veracode vs SonarQube Logo
Veracode vs SonarQube
Compared 9% of the time
GitHub Advanced Security vs SonarQube Logo
GitHub Advanced Security vs SonarQube
Compared 7% of the time
Snyk vs SonarQube Logo
Snyk vs SonarQube
Compared 5% of the time
More SonarQube Competitors
 

Product Reports

Buyer's Guide
Checkmarx One
July 2024
Checkmarx One reportDownload Checkmarx One product report
Buyer's Guide
SonarQube
June 2024
SonarQube reportDownload SonarQube product report
 

Also Known As

No data available
Sonar
 

Learn More

Checkmarx
Sonar
 

Interactive Demo

Demo not available
Checkmarx
Sonar
 

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • API security
  • Dynamic Application Security Testing (DAST)
  • Container security
  • IaC security
  • Correlation, prioritization, and risk management
  • Codebashing secure code training
  • AI security
  • Tech partnerships extending AppSec into runtime analysis
  • Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

 

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Buyer's Guide
Checkmarx One vs. SonarQube
July 2024
Free Report: Checkmarx One vs. SonarQube
Find out what your peers are saying about Checkmarx One vs. SonarQube and other solutions. Updated: July 2024.
DOWNLOAD NOW
793,295 professionals have used our research since 2012.
See our Checkmarx One vs. SonarQube report.
See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.